Vulnerability-Lookup

CVE-2026-24769 (GCVE-0-2026-24769)

Vulnerability from cvelistv5 – Published: 2026-01-28 20:36 – Updated: 2026-01-29 14:02

Title

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

Summary

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.

Severity ?

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M

References

URL

Tags

https://github.com/nocodb/nocodb/security/advisor…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	nocodb	nocodb	Affected: < 0.301.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T14:00:29.747478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T14:02:12.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nocodb",
          "vendor": "nocodb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.301.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB\u2019s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application\u2019s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T20:36:23.859Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr"
        }
      ],
      "source": {
        "advisory": "GHSA-q5c6-h22r-qpwr",
        "discovery": "UNKNOWN"
      },
      "title": "NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24769",
    "datePublished": "2026-01-28T20:36:23.859Z",
    "dateReserved": "2026-01-26T21:06:47.868Z",
    "dateUpdated": "2026-01-29T14:02:12.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-24769\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-28T21:16:12.587\",\"lastModified\":\"2026-01-29T16:31:00.867\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB\u2019s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application\u2019s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"references\":[{\"url\":\"https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload\", \"source\": {\"advisory\": \"GHSA-q5c6-h22r-qpwr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"nocodb\", \"product\": \"nocodb\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.301.0\"}]}], \"references\": [{\"url\": \"https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr\", \"name\": \"https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB\\u2019s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application\\u2019s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434: Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-28T20:36:23.859Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-24769\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-29T14:00:29.747478Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-01-29T14:01:36.098Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-24769\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-28T20:36:23.859Z\", \"dateReserved\": \"2026-01-26T21:06:47.868Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-28T20:36:23.859Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-Q5C6-H22R-QPWR

Vulnerability from github – Published: 2026-01-28 21:41 – Updated: 2026-01-28 21:41

Summary

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

Details

Summary

A stored Cross-site Scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment.

Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.

Vulnerability Details

NocoDB allows file attachments to be previewed inline based on their MIME type. Due to overly permissive MIME type checks and a lack of content sanitization, SVG files containing executable JavaScript are incorrectly treated as safe image content and rendered directly in the browser.

Root Cause

The vulnerability results from a combination of overly permissive MIME type classification and unsafe file serving behavior.

1. Permissive MIME Type Check

In attachmentHelpers.ts, files are considered previewable if their MIME type contains certain substrings:

const previewableMimeTypes = ['image', 'pdf', 'video', 'audio'];

export const isPreviewAllowed = (args: { mimetype?: string } = {}) => {
  const { mimetype } = args;
  if (!mimetype) return false;
  return previewableMimeTypes.some((type) => mimetype.includes(type));
};

This substring-based check (includes) causes files with the MIME type image/svg+xml to be classified as safe for inline preview. However, SVG is an XML-based format that supports executable JavaScript via <script> elements, event handlers, and external references.

No additional validation or sanitization is performed on SVG content after this classification.

2. Unsafe Inline File Serving

Uploaded attachments are served by the fileReadv3 endpoint in attachments.controller.ts without sanitization or content-type enforcement:

@Get('/dltemp/:param(*)')
async fileReadv3(@Param('param') param: string, @Res() res: Response) {
  // No authentication guard

  // Sets headers from query parameters
  res.setHeader('Content-Type', queryParams.contentType);
  res.setHeader('Content-Disposition', queryParams.contentDisposition);

  // Sends raw file content
  res.sendFile(file.path);
}

The endpoint:

Preserves the original Content-Type (image/svg+xml)
Uses Content-Disposition: inline
Sends the raw file contents unmodified

As a result, browsers render the SVG inline and execute any embedded JavaScript under the NocoDB application’s origin.

Impact

This is a stored XSS vulnerability that can be exploited by authenticated users with permission to upload attachments.

Potential impacts include:

Account takeover
Theft of session cookies or API tokens
Unauthorized actions performed on behalf of victims
Privilege escalation if higher-privileged users view the malicious attachment

Credit

This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Severity ?

8.5 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nocodb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.301.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-28T21:41:03Z",
    "nvd_published_at": "2026-01-28T21:16:12Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA **stored Cross-site Scripting (XSS)** vulnerability exists in NocoDB\u2019s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment.\n\nBecause the malicious payload is stored server-side and executed under the application\u2019s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.\n\n---\n\n## Vulnerability Details\n\nNocoDB allows file attachments to be previewed inline based on their MIME type. Due to overly permissive MIME type checks and a lack of content sanitization, SVG files containing executable JavaScript are incorrectly treated as safe image content and rendered directly in the browser.\n\n### Root Cause\n\nThe vulnerability results from a combination of **overly permissive MIME type classification** and **unsafe file serving behavior**.\n\n#### 1. Permissive MIME Type Check\n\nIn `attachmentHelpers.ts`, files are considered previewable if their MIME type contains certain substrings:\n\n```ts\nconst previewableMimeTypes = [\u0027image\u0027, \u0027pdf\u0027, \u0027video\u0027, \u0027audio\u0027];\n\nexport const isPreviewAllowed = (args: { mimetype?: string } = {}) =\u003e {\n  const { mimetype } = args;\n  if (!mimetype) return false;\n  return previewableMimeTypes.some((type) =\u003e mimetype.includes(type));\n};\n```\n\nThis substring-based check (`includes`) causes files with the MIME type `image/svg+xml` to be classified as safe for inline preview. However, SVG is an XML-based format that supports executable JavaScript via `\u003cscript\u003e` elements, event handlers, and external references.\n\nNo additional validation or sanitization is performed on SVG content after this classification.\n\n#### 2. Unsafe Inline File Serving\n\nUploaded attachments are served by the `fileReadv3` endpoint in `attachments.controller.ts` without sanitization or content-type enforcement:\n\n```ts\n@Get(\u0027/dltemp/:param(*)\u0027)\nasync fileReadv3(@Param(\u0027param\u0027) param: string, @Res() res: Response) {\n  // No authentication guard\n\n  // Sets headers from query parameters\n  res.setHeader(\u0027Content-Type\u0027, queryParams.contentType);\n  res.setHeader(\u0027Content-Disposition\u0027, queryParams.contentDisposition);\n\n  // Sends raw file content\n  res.sendFile(file.path);\n}\n```\n\nThe endpoint:\n\n* Preserves the original `Content-Type` (`image/svg+xml`)\n* Uses `Content-Disposition: inline`\n* Sends the raw file contents unmodified\n\nAs a result, browsers render the SVG inline and execute any embedded JavaScript under the NocoDB application\u2019s origin.\n\n---\n\n## Impact\n\nThis is a **stored XSS** vulnerability that can be exploited by authenticated users with permission to upload attachments.\n\nPotential impacts include:\n\n* Account takeover\n* Theft of session cookies or API tokens\n* Unauthorized actions performed on behalf of victims\n* Privilege escalation if higher-privileged users view the malicious attachment\n\n---\n\n## Credit\n\nThis issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter St\u00f6ckli) and @m-y-mo (Man Yue Mo).",
  "id": "GHSA-q5c6-h22r-qpwr",
  "modified": "2026-01-28T21:41:03Z",
  "published": "2026-01-28T21:41:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24769"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nocodb/nocodb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload"
}

FKIE_CVE-2026-24769

Vulnerability from fkie_nvd - Published: 2026-01-28 21:16 - Updated: 2026-01-29 16:31

Severity ?

8.5 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB\u2019s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application\u2019s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue."
    }
  ],
  "id": "CVE-2026-24769",
  "lastModified": "2026-01-29T16:31:00.867",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-28T21:16:12.587",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-24769 (GCVE-0-2026-24769)

GHSA-Q5C6-H22R-QPWR

Summary

Vulnerability Details

Root Cause

1. Permissive MIME Type Check

2. Unsafe Inline File Serving

Impact

Credit

FKIE_CVE-2026-24769

Tags

Sightings

Nomenclature